FreeBSD Security Advisory (Bind)

ulovko

The FreeBSD Security Team has identified an issue in Bind and has issued the following security advisory: FreeBSD-SA-12:05.bind.asc (06/08/2012).

I. Background

BIND 9 is an implementation of the Domain Name System (DNS) protocols. The named( daemon is an Internet Domain Name Server.

DNS Security Extensions (DNSSEC) provides data integrity, origin authentication and authenticated denial of existence to resolvers.

II. Problem Description

BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broken chain of trust. Under high query loads, when DNSSEC validation is active, it is possible for a condition to arise in which data from this cache of failing queries could be used before it was fully initialized, triggering an assertion failure.

III. Impact

A remote attacker that is able to generate high volume of DNSSEC validation enabled queries can trigger the assertion failure that causes it to crash, resulting in a denial of service.

For a workaround and solution, check out the security advisory: FreeBSD-SA-12:05.bind.asc

FROM:  http://security.freebsd.org/advisories/FreeBSD-SA-12:05.bind.asc
FROM:  http://www.freebsd.org/security/index.html

tiger88_cu

回复 1# ulovko

按照源码安装方法进行安装，安装完成后，执行named -v ,版本号为啥都一样，没有变化？
BIND 9.6.-ESV-R3

如何确认是是否升级成功？


a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-12:05/bind.patch
# fetch http://security.FreeBSD.org/patches/SA-12:05/bind.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/bind/dns
# make obj && make depend && make && make install
# cd /usr/src/usr.sbin/named
# make obj && make depend && make && make install


   

macafee

喜欢ＰＯＷＥＲＤＮＳ